Software Composition Analysis (SCA) is a software vulnerability testing method. Further reading Software Composition Analysis (Wikipedia) What is SCA? (Palo Alto Networks) SAST vs. SCA testing: What’s the difference? Can they be combined? - Snyk blog
Context For the mid-career technologist or governance lead, understanding the mechanics of code analysis is less about mastering coding or tooling, and more about understanding where risk is introduced. If you are responsible for product integrity or release management, relying solely on pre-release testing is a failing strategy. This note explains the foundational principles of inspecting code at rest, arguably the first line of defence in a secure development lifecycle. ...
Further reading Security Testing - UK Cyber Security Council Continually test your security - NCSC Penetration testing - NCSC Guidance Perform security​ testing - Microsoft Security Engineering
Zed Attack Proxy is a free and open-source web app scanner, originally developed within the OWASP community, with the project now managed by Checkmarx. Further reading Top 8 penetration testing tools (Snyk Blog) ZAP (Wikipedia) Zed Attack Proxy, by CheckMarx Install ZAP on MacOS (Homebrew) Related pages OWASP